I'm setting up an alert to perfom an action when volumes reached threshold of available space. I'm trying to valide the number of time the action would run by recreating the trigger conditions via SWQL
SELECT n.caption, n.ipaddress, n.IP_Address, v.VolumeSize, v.VolumeSpaceAvailable, v.VolumePercentAvailable, v.VolumeType, v.VolumeDescription, v.VolumeID, v.VolumeIndex, v.DisplayName,v.FullName
from orion.nodes n
left join orion.Volumes v on n.NodeID = v.NodeID
WHERE v.VolumeSize IS NOT NULL
AND v.VolumePercentAvailable < 20
AND v.VolumePercentAvailable > 10
AND v.VolumeType = 'Fixed Disk'
AND v.VolumeSize < 1000000000000
AND v.DisplayName LIKE '%C:\%'
This returns 30 rows whereas my Alert Summary returns 18. The reason seems to be some quasi duplication created when the server build teams use a template to build the servers. That is, I can have a few different servers with the same drive label. I was not expecting this. If I understand what would happen here according to Alert Summary, I'm only going to produce one Alert/Action instead of 3?
C:\ Label: 089AA081 | SERVER1-C:\ Label: 089AA081 |
C:\ Label: 089AA081 | SERVER2-C:\ Label: 089AA081 |
C:\ Label: 089AA081 | SERVER3-C:\ Label: 089AA081 |